summaryrefslogtreecommitdiff
path: root/machines/xnet
diff options
context:
space:
mode:
Diffstat (limited to 'machines/xnet')
-rw-r--r--machines/xnet/default.nix137
-rw-r--r--machines/xnet/gitserver/default.nix7
-rw-r--r--machines/xnet/net/default.nix4
-rw-r--r--machines/xnet/net/dns.nix39
-rw-r--r--machines/xnet/net/sshd.nix6
5 files changed, 131 insertions, 62 deletions
diff --git a/machines/xnet/default.nix b/machines/xnet/default.nix
index 138bd53..808bebc 100644
--- a/machines/xnet/default.nix
+++ b/machines/xnet/default.nix
@@ -1,6 +1,23 @@
-{ pkgs, lib, ... }:
+{ pkgs, lib, config, ... }:
let
- inherit (lib) mkDefault;
+ inherit (builtins)
+ fetchurl
+ filter
+ readFile
+ ;
+
+ inherit (lib)
+ mkDefault
+ mkOption
+ types
+ splitString
+ ;
+
+ gitKeys = fetchurl {
+ url = "https://github.com/kbujari.keys";
+ sha256 = "1kskbiyqvjz1wsmcrgh9v0iryf33y70zk503z0m96wmzdjllmc94";
+ };
+
in
{
imports = [
@@ -13,67 +30,81 @@ in
./monitoring
];
- i18n.defaultLocale = mkDefault "en_US.UTF-8";
- time.timeZone = mkDefault "America/Toronto";
-
- nix = {
- settings = {
- auto-optimise-store = true;
- experimental-features = [ "nix-command" "flakes" ];
- warn-dirty = false;
-
- # timeout fast from binary cache
- connect-timeout = 5;
- };
- gc = {
- automatic = true;
- options = mkDefault "--delete-older-than 30d";
+ options.xnet = {
+ pubKeys = mkOption {
+ type = types.listOf types.str;
+ default = filter (s: s != "")
+ (splitString "\n" (readFile gitKeys));
};
};
- documentation = {
- doc.enable = mkDefault false;
- info.enable = mkDefault false;
- };
+ config = {
+ i18n.defaultLocale = mkDefault "en_US.UTF-8";
+ time.timeZone = mkDefault "America/Toronto";
- users.mutableUsers = false;
+ nix = {
+ settings = {
+ auto-optimise-store = true;
+ experimental-features = [ "nix-command" "flakes" ];
+ warn-dirty = false;
- security.sudo = {
- execWheelOnly = true;
- extraConfig = "Defaults lecture = never";
- };
+ # timeout fast from binary cache
+ connect-timeout = 5;
+ };
+ gc = {
+ automatic = true;
+ options = mkDefault "--delete-older-than 30d";
+ };
+ };
- programs.ssh = {
- knownHosts = {
- "github.com".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl";
- "gitlab.com".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAfuCHKVTjquxvt6CM6tdG4SLp1Btn/nOeHHE5UOzRdf";
- "git.sr.ht".publicKey = " ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMZvRd4EtM7R+IHVMWmDkVU3VLQTSwQDSAvW0t2Tkj60";
- "pascal.ee.ryerson.ca".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFmWInQNT6EoU1NtUYzTs5jtpfbO/m6yvCckOiEGjvDc";
+ documentation = {
+ doc.enable = mkDefault false;
+ info.enable = mkDefault false;
};
- extraConfig = ''
- Host github
- HostName github.com
- User git
- PreferredAuthentications publickey
- Host ee
- HostName pascal.ee.ryerson.ca
- User kbujari
- '';
- };
+ users.mutableUsers = false;
+ users.users.root = {
+ openssh.authorizedKeys.keys = config.xnet.pubKeys;
+ initialPassword = "hello";
+ };
+
+ security.sudo = {
+ execWheelOnly = true;
+ extraConfig = "Defaults lecture = never";
+ };
+
+ programs.ssh = {
+ knownHosts = {
+ "github.com".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl";
+ "gitlab.com".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAfuCHKVTjquxvt6CM6tdG4SLp1Btn/nOeHHE5UOzRdf";
+ "git.sr.ht".publicKey = " ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMZvRd4EtM7R+IHVMWmDkVU3VLQTSwQDSAvW0t2Tkj60";
+ "pascal.ee.ryerson.ca".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFmWInQNT6EoU1NtUYzTs5jtpfbO/m6yvCckOiEGjvDc";
+ };
+ extraConfig = ''
+ Host github
+ HostName github.com
+ User git
+ PreferredAuthentications publickey
- programs.git = {
- enable = true;
- config = {
- init.defaultBranch = "master";
- fetch.prune = true;
- core.excludesFile = pkgs.writeText "gitignore" ''
- # dev shell caching
- .direnv/
- .envrc
+ Host ee
+ HostName pascal.ee.ryerson.ca
+ User kbujari
'';
- push.default = "upstream";
- push.autoSetupRemote = true;
+ };
+
+ programs.git = {
+ enable = true;
+ config = {
+ init.defaultBranch = "master";
+ fetch.prune = true;
+ core.excludesFile = pkgs.writeText "gitignore" ''
+ # dev shell caching
+ .direnv/
+ .envrc
+ '';
+ push.default = "upstream";
+ push.autoSetupRemote = true;
+ };
};
};
}
diff --git a/machines/xnet/gitserver/default.nix b/machines/xnet/gitserver/default.nix
index da83f73..2152ebd 100644
--- a/machines/xnet/gitserver/default.nix
+++ b/machines/xnet/gitserver/default.nix
@@ -18,11 +18,6 @@ in
default = "/persist/repo/git";
description = "Directory where repos will be stored.";
};
-
- keys = mkOption {
- type = types.listOf types.str;
- description = "SSH public keys used for git operations.";
- };
};
config = mkIf cfg.enable {
@@ -34,7 +29,7 @@ in
homeMode = "755";
createHome = true;
shell = "${pkgs.git}/bin/git-shell";
- openssh.authorizedKeys.keys = cfg.keys;
+ openssh.authorizedKeys.keys = config.xnet.pubKeys;
};
users.groups.git = { };
diff --git a/machines/xnet/net/default.nix b/machines/xnet/net/default.nix
index 9673792..8258ea6 100644
--- a/machines/xnet/net/default.nix
+++ b/machines/xnet/net/default.nix
@@ -59,6 +59,7 @@ in
{
imports = [
./sshd.nix
+ ./dns.nix
];
options.xnet.net = {
@@ -76,6 +77,9 @@ in
};
config = mkIf ((length cfg.join) > 0) {
+ # networkd will handle this
+ networking.useDHCP = false;
+
systemd.network =
let
name = config.networking.hostName;
diff --git a/machines/xnet/net/dns.nix b/machines/xnet/net/dns.nix
new file mode 100644
index 0000000..579d6aa
--- /dev/null
+++ b/machines/xnet/net/dns.nix
@@ -0,0 +1,39 @@
+{ ... }: {
+ services.resolved.enable = false;
+
+ services.unbound = {
+ enable = true;
+ settings.server = {
+ interface = [ "127.0.0.1" ];
+ access-control = [
+ "0.0.0.0/0 refuse"
+ "127.0.0.0/8 allow"
+ ];
+
+ private-domain = [ ];
+ private-address = [ ];
+
+ harden-glue = true;
+ harden-dnssec-stripped = true;
+ use-caps-for-id = false;
+ prefetch = true;
+ edns-buffer-size = 1232;
+ hide-identity = true;
+ hide-version = true;
+ tls-system-cert = true;
+ };
+
+ settings.forward-zone = [{
+ name = ".";
+ forward-tls-upstream = true;
+ forward-addr = [
+ "9.9.9.9#dns.quad9.net"
+ "149.112.112.112#dns.quad9.net"
+ ];
+ }];
+ };
+
+ networking = {
+ nameservers = [ "::1" ];
+ };
+}
diff --git a/machines/xnet/net/sshd.nix b/machines/xnet/net/sshd.nix
index b7cacc2..9d7976e 100644
--- a/machines/xnet/net/sshd.nix
+++ b/machines/xnet/net/sshd.nix
@@ -22,10 +22,10 @@ in
type = "ed25519";
}];
settings = {
- UsePAM = true;
+ UsePAM = false;
X11Forwarding = false;
- PermitRootLogin = "yes";
- # PasswordAuthentication = false;
+ PermitRootLogin = "prohibit-password";
+ PasswordAuthentication = false;
Ciphers = [ "chacha20-poly1305@openssh.com" ];
Macs = [ "hmac-sha2-512-etm@openssh.com" ];
KexAlgorithms = [ "curve25519-sha256@libssh.org" ];
generated by cgit v1.3.1 (git 2.54.0) at 2026-09-04 07:34:24 +0000